This makes 2-Step Verification available for your users, but does not automatically enroll them. To enroll, users need to configure their verification settings individually. See Turn on 2-Step Verification.

Consider running a pilot program targeting users with smartphones. You can set up a deployment day where your users take their phones and laptops to your Help Desk. We recommend that your IT staff sets up 2-Step Verification for your users and enters App Passwords where needed in their mobile devices and desktop applications.

Provide a lead time for users to enroll in 2-Step Verification before enforcement

Once you have enabled User enrollment to 2-step verification, you'll need all your users to enroll before you activate enforcement. You can give your users a monitored amount of time to enroll.

Use the calendar controls or enter a date by hand to specify an ending date when all users will have deployed 2-Step Verification. We recommend that this date be two to four weeks in the future.

Once you have enabled Turn on enforcement from date, your users will see an interstitial page each time they login and will also receive reminder emails until they enroll. These emails are sent once a week and then daily for the last five days before the ending date. On the ending date your users who have not yet enrolled will be required to enroll before they can login.

Disable 2-Step Verification for your domain

Uncheck Allow users to turn on 2-step verification to prevent new enrollments or modification of existing enrollments. Users who have already enrolled would continue to be asked for a 2-Step Verification code.

Unenroll individual users

In your Admin console, go to the Users page.

Click an individual user.

Unenroll the user by clicking Show more > Security.

This change takes effect immediately. The user also receives an automated email from Google explaining that they are no longer enrolled.